(ii) A counterparty may disclose protected health information to a counterparty that is a subcontractor and may authorize the subcontractor to produce, receive, maintain or transmit protected health information on its behalf if the counterparty receives satisfactory assurances, in accordance with subsection 164.504 (e) (1) (i), that the processor adequately protects the information. 1. Except as provided for in point (b)(2) of paragraph (a)(5) of this Section, the disclosure of protected health information by an undertaking or counterparty, where applicable, where the entity or counterparty concerned receives, directly or indirectly, remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information. 5. If the counterparty uses subcontractors or other companies to provide services to the covered entity in which PHI is involved, you execute counterparty agreements with the subcontractors. (45 CFR 164.314 (a) and 164.504 (e)). (3) Counterparties: permitted uses and advertisements. A counterparty may only use or disclose protected health information if its counterparty agreement or other agreement under section 164.504(e) authorizes, requires or requires it by law. The counterparty may not use or disclose protected health information in a manner that would be contrary to the requirements of this Subsection if the covered enterprise does so, except for the purposes referred to in paragraph 164.504 (e) 2)(a) or (B) if such uses or disclosures are permitted by its contract or other agreements. (4) Implementation specifications: data use agreement – (i) agreement required. A data subject entity may only use or disclose a limited set of data referred to in paragraph (e) (1) of this Section if, in the form of a data use agreement that meets the requirements of this Section, the data subject entity obtains satisfactory assurance that the recipient of the restricted data set will only use or disclose the protected health information for limited purposes. (2) Information of individuals. In accordance with paragraph (b) of this section, the company concerned must inform the interested party in good time of the acceptance of the modification and request the identification of the person and the agreement of the data subject so that the entity concerned informs the data subjects with whom the modification referred to in paragraph (c) (3) of this section is to be communicated.
(d) Standard: use and disclosure of anonymous protected health information – (1) use and disclosure for the production of anonymized information. The entity concerned may use protected health information to produce information that is not individually identifiable or disclose protected health information only to a counterparty for that purpose, whether or not the anonymised information is used by the classified entity. (i) determine the use and disclosure of health information protected by the counterparty that is authorized and necessary. The contract shall not allow the counterparty to use or disclose the information in a manner that would be contrary to the requirements of this subsection if it does so by the covered entity, with the exception of: (e) (1) Standard: information to counterparties. (i) A relevant entity may disclose protected health information to a counterparty and allow a counterparty to produce, receive, maintain or transmit protected health information on its behalf, if the entity concerned obtains satisfactory assurance that the counterparty adequately protects the information. A covered enterprise is not required to obtain such satisfactory assurances from a counterparty that is a subcontractor. . . .